CVE-2024-0853
Fixed in a distro release EPSS 1%CVSS 5.3
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status (*OCSP stapling*) test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check.
Products: curl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.17 | curl | 8.6.0-r0 |
| Alpine 3.18 | curl | 8.6.0-r0 |
| Alpine 3.19 | curl | 8.6.0-r0 |
| Alpine 3.20 | curl | 8.6.0-r0 |
| Alpine 3.21 | curl | 8.6.0-r0 |
| Alpine 3.22 | curl | 8.6.0-r0 |
| Alpine 3.23 | curl | 8.6.0-r0 |
| Alpine 3.24 | curl | 8.6.0-r0 |
| Chainguard | curl | 8.6.0-r0 |
| Chainguard | curl-dev | 8.6.0-r0 |
| Chainguard | curl-doc | 8.6.0-r0 |
| Chainguard | curl-oci-entrypoint | 8.6.0-r0 |
| Chainguard | curl-static | 8.6.0-r0 |
| Chainguard | libcurl-openssl4 | 8.6.0-r0 |
| Chainguard | libcurl4 | no fix |
| Chainguard | libcurl4 | 8.6.0-r0 |
| Debian 13 | curl | 8.6.0-1 |
| Debian 14 | curl | 8.6.0-1 |
| Ubuntu 24.04 LTS | curl | 8.5.0-2ubuntu2 |
| Wolfi | curl | 8.6.0-r0 |
| Wolfi | curl-dev | 8.6.0-r0 |
| Wolfi | curl-doc | 8.6.0-r0 |
| Wolfi | curl-oci-entrypoint | 8.6.0-r0 |
| Wolfi | curl-static | 8.6.0-r0 |
| Wolfi | libcurl-openssl4 | 8.6.0-r0 |
| Wolfi | libcurl4 | 8.6.0-r0 |
| Wolfi | libcurl4 | no fix |
| openSUSE Tumbleweed | curl | 8.6.0-1.1 |